Repository navigation
ci: fail the Branch protection check when a job it waits on does not succeed - #3840
Merged
armando-navarro merged 2 commits intoNov 6, 2026
Merged
armando-navarro merged 2 commits into
armando-navarro merged 2 commits into
Conversation
…succeed The job is main's required status check. Without an if: it was skipped whenever test, contribute, browser or firebase-13 failed, and GitHub counts a skipped required check as satisfied, so a pull request with red tests stayed mergeable. Now the job always runs and exits 1 unless every needed job succeeded. skipped is included because a failed build skips three of the four jobs rather than failing them, and always() rather than !cancelled() because a cancelled run must also leave the check red. Found by Tyler Reitz on angular#3762.
armando-navarro
added
comp: build/pipeline
tyler-reitz
approved these changes
Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3839
The
Branch protectionjob ismain's required CI check, and it was skipped, which GitHub counts as passing, whenever one of the jobs it waits on failed. The evidence and the proof runs are in #3839.Changes
if: ${{ always() }}on the job, so it runs on every outcome oftest,contribute,browserandfirebase-13.One step that exits 1 when any of those results is
failure,cancelledorskipped.skippedis included because a failedbuildskips three of the four jobs rather than failing them.A two-line comment saying why the job uses
always()and not!cancelled().The job name is unchanged, so the branch protection setting does not change.
Behavior to know
buildnow leaves the check red. Before,contributecould pass on its own and the check would be skipped.Verified
The same job on a throwaway repository with the same job graph: red on a failed test leg, a failed build and a cancelled run, green when everything passes, and the old job skipped on a failed test leg.
This pull request's own run exercises the all-pass case.